Path Traversal Vulnerability in OpenClaw Canvas by OpenClaw

CVE-2026-3689

What is CVE-2026-3689?

The OpenClaw Canvas is susceptible to a path traversal vulnerability that permits remote attackers to disclose sensitive information. This weakness arises from inadequate validation of user-supplied path parameters before they are processed in file operations. Although authentication is mandatory for exploitation, an attacker could exploit this flaw to access the service account's information, thereby compromising the confidentiality of the data. This issue has been documented as ZDI-CAN-29312 and requires immediate attention to mitigate potential risks.

References